Nx Maven and Gradle plugins: OS command injection (CVE-2026-119282)

The Nx plugins @nx/maven and @nx/gradle are susceptible to OS command injection due to insecure interpolation of plugin options from nx.json into shell commands. This vulnerability is triggered whenever an nx command initiates project-graph analysis in a workspace containing a maliciously crafted nx.json.

For @nx/maven, the injectable option is targetNamePrefix. For @nx/gradle, the vulnerability is more extensive, as arbitrary plugin option names and values are interpolated into command-line arguments. This flaw poses a risk to CI environments and local developers working within untrusted repositories. There is no evidence of active exploitation in the wild.

Impact

Successful exploitation allows arbitrary command execution under the privileges of the user running the nx command. This represents a significant risk in automated CI pipelines that process pull requests or external repositories, as an attacker with write access to the nx.json file can execute code without requiring access to build files themselves.

Recommendation

• Upgrade @nx/maven and @nx/gradle to version 22.7.9 (for the 22.x line) or 23.1.2 (for the 23.x line) or later.
• Upgrading the plugin alone is insufficient; users must ensure the core nx package is also upgraded to a compatible version as the fix depends on updated core code.
• Use nx migrate 23.1.2 to update the project dependencies.
• Until updates are applied, restrict the execution of nx commands to repositories from trusted sources only.